Skip to content
Sign in

Privacy policy

Last updated: 27 October 2026

Creative Districts Africa (CDA), Kenya, operates this service and is responsible for the personal information described here. For privacy questions or requests, email support@creativedistricts.africa.

Information you provide

  • Account information. When you sign up or sign in, our authentication provider, Clerk, processes your name, email address, credentials, verification and session information. If you choose Google sign-in, Google shares the basic identity information you authorise, such as your name, email address and profile image. CDA does not request access to your Gmail messages, contacts or Google Drive files. In Account settings you can change your sign-in email (Clerk emails a 6-digit code to confirm the new address), connect or disconnect Google, and see the devices signed in to your account: for each, the browser, device type, approximate city and country, and when it was last active, as Clerk records them. These changes may ask you to confirm it’s you with a code.
  • Optional profile. You can provide your country, creative disciplines, career stage, interests, organisation and website. These details are private account information, not a public creator profile. If you’re signed in, an opportunity or programme page uses your country and fields to show how it fits you, unless you arrived from a guided search, whose answers it uses instead.
  • Guided search answers. If you use the guided search, your answers (the fields you work in, whether you’re applying as an individual, team or organisation, where you’re based, where the work can take place, an amount range, a deadline window and keywords) are used as search input to filter and order listings. They aren’t linked to your account unless you save them in an alert.
  • Saved resources and alerts. We store the resources you save, whether you marked one as applied, and whether you turned on deadline reminders. For alerts you create we store their names, search text, filters, the search answers they carry, how often they email you, whether they remind you before deadlines, and whether they are on or paused. All of this is linked to your account.
  • Corrections and suggestions. If you suggest a correction or a listing, we store what you send: the listing or organisation it’s about, the topic, your message, any link you add, and for a suggestion its name, organisation, dates, place and who it’s for. You don’t need an account. Your email is optional, except when you correct your own organisation’s page, where we ask for a work email and, optionally, your name and role.
  • Support. If you contact us, we receive your contact details and the information you include in your message.

You can browse public listings without an account. An account is needed to save resources or manage alerts. Profile fields are optional. Please keep passwords, identity documents and sensitive personal information out of search text, profile fields and alert names.

Search, activity and technical information

We process your search text and filters to find resources. Each search record stores a request identifier, a hashed fingerprint of the search (your words, filters and any guided answers together; the words and answers themselves aren’t stored in it), the country filter you chose, if any, how many results of each type it found, whether an AI interpretation was used, and the time. When a search asks for production help, or you tell us who you’re looking for on collaboration requests, we also record that need, whether you asked or it was inferred, the creative fields involved, the country filter and the number of results. Your search words, filters and answers are part of the results page’s web address, so they appear in your browser history, in our hosting provider’s request logs and in any link you share. Outbound-link records contain an event identifier, resource, link type, whether the link was on the website or in an email, and time. These analytics records are not linked to an account ID in CDA’s database. When you’re signed in and open a listing’s apply or official-site link, we also record, linked to your account, which listing you opened and when. We use this only to ask whether you applied and to keep your Saved list up to date; it does not change your search results. Your answer (Applied, Not yet or Not for me) is stored with it. If you don’t answer, we delete the record after 60 days. Links in our emails go through CDA so we can count opens of each listing; those records are not linked to your account. Saved alerts separately retain the search text you choose to save.

Hosting and authentication services process technical information such as IP addresses, browser and device information, requests, session activity and errors to deliver and protect the service. CDA’s request-limit counters use a keyed hash of an IP address or account identifier. A hash is not a promise of anonymity. Search currently does not send your query to an AI provider.

Search engines and link previews

While CDA’s public listings are open, search engines such as Google can list the home page, How we verify and each published listing, and we publish a sitemap of those pages. Search results, account, admin and other pages ask search engines not to list them. Collaboration requests, which show the poster’s first name, last initial, role and town with their consent, are not offered to search engines and are left out of the sitemap. Like any page, they can still show a preview when someone shares the link.

When someone shares a CDA link in a messaging app or on social media, that service fetches the page and its preview image from CDA. A listing’s preview image shows its type, title and illustration, never dates or verification status. Search engines and those services keep their own copies on their own schedules, so an older version can appear for a while after a listing changes or is removed. We can’t control those copies; you can ask a search engine to refresh or remove an outdated result.

How we use information

We use information to provide accounts, saved resources and alerts; respond to support requests; understand catalogue demand and resource engagement; prevent abuse; and administer access and investigate problems. Where a legal basis is required, we rely on providing the service you request, consent for optional information and alerts, our legitimate interests in operating and securing CDA, and applicable legal obligations. You can withdraw optional choices without closing your account.

Search results help you discover resources. They do not decide whether you qualify for funding, admission or another opportunity. The listed provider makes those decisions.

Email, cookies and browser storage

Clerk sends authentication and account-security emails. When email delivery is available and you enable an alert, Zoho ZeptoMail processes your email address and the message content to deliver matching resources. If you turn on deadline reminders (they are off until you do), or an alert’s reminder, we email you about three days before a listing with a deadline closes: a saved listing, or one that alert already sent you. We keep a record of each email we send (its purpose, recipient, the listing it was about, delivery status, attempts and provider references) so we never send the same one twice, and record bounced addresses or complaints to prevent further unwanted or undeliverable messages. CDA’s sender disables email-open and email-click tracking.

You can pause or delete an alert in Alerts and turn deadline reminders off in Saved. Alert emails include a pause link, reminder emails a link to stop reminders for that listing or altogether, and both support one-click unsubscribe. Pausing alerts or stopping reminders does not stop authentication or security emails.

Clerk uses cookies and similar browser storage for sign-in, session continuity and security. CDA does not currently install advertising cookies or a separate marketing or session-replay analytics tool. Your browser can block or delete cookies, but account features may stop working.

CDA keeps a few things in your browser’s session storage, which your browser clears when you close the tab: the results of your three most recent searches for 30 minutes, so Back and reload don’t search again; an identifier for each search in that tab, kept with its words, filters and answers, so a reload isn’t counted as a new search; a note to show the loading screen once; and, if you tap Save or Get alerts while signed out, that action (the listing or the alert link, and the page you were on) for up to 10 minutes, so it can finish after you sign in. It is removed once used or expired. None of this reaches CDA except the searches you run and, once you’re signed in, the save or alert you asked for.

Corrections and suggestions

A curator checks every correction and suggestion against official sources. Only authorised CDA staff can see them; we never show your name, email or message on the site. We don’t visit links you share automatically: a curator opens them.

If you leave your email, we use it only for this report: a one-time confirmation that it arrived, a message telling you whether a suggested listing went live, and, if a curator needs to, a reply to check details. If you ask to hear when organisation accounts open, we keep your email to tell you once, and you can withdraw by emailing support@creativedistricts.africa. To prevent misuse, request-limit counters use a keyed hash of your IP address and of the email you enter.

We delete your name, role and email 90 days after your report is resolved, unless you asked to hear when organisation accounts open; then we keep your email until we send that notice or you withdraw. Reports marked as spam lose their contact details after 30 days. The report itself (topic, message, links and its history) stays as a record of changes to the catalogue.

Who receives information

Authorised CDA administrators can access account information and recorded activity to operate and support the service. Our main service providers are:

  • Clerk for authentication, account management and security emails.
  • Vercel for website hosting, request processing and catalogue image storage.
  • Neon for the database holding CDA account and catalogue records.
  • Zoho ZeptoMail for alert delivery, report emails and delivery feedback.
  • Google when you choose Google sign-in.
  • TypeSafe to suggest resource types from public page titles, summaries, publisher names and page text when staff import catalogue sources.
  • Context.dev to read a public source page that CDA cannot read directly when staff import catalogue sources.

These providers operate internationally. Information may be processed outside Kenya, including in the United States. Their privacy and data-processing terms describe their practices and safeguards; contact us for information about transfers affecting your data. We do not sell your personal information or use it for targeted advertising. We may disclose information where required by law or necessary to address a security incident.

Public catalogue listings may include professional information from their named sources. Following an external source or application link takes you to another organisation’s service and privacy practices. CDA does not submit an application on your behalf.

Retention and deletion

Your profile, saves and alerts remain available while your account exists unless you edit or remove them. When your account is deleted, whether you do it in Account settings or we act on a verified request, CDA removes your profile, saves, alerts, reminder settings, the record of listings you opened and your answers, and associated delivery and email records. We retain a minimal account identifier and deletion record to prevent a deleted account being recreated by stale requests and to preserve historical audit records. Contact details in corrections and suggestions follow the schedule in Corrections and suggestions.

Account deletion does not automatically remove staff-access and moderation audits, email suppression records, webhook event identifiers, or search and outbound-link records that are not linked to your account. Suppression records retain the email address and reason so we can avoid sending to it again. These records do not currently have a fixed automatic expiry. Expired request-limit counters are removed by scheduled maintenance.

Provider logs and backups follow the relevant provider’s retention practices and are not necessarily erased at the same time as the active application data. Contact us to request deletion or ask about retained information; we will assess what can be removed and explain any information that needs to be retained.

Your choices and rights

You can edit or clear optional details in Profile, remove saved resources, and pause or delete alerts. In Account settings you can change your sign-in email, connect or disconnect Google, sign out devices you don’t recognise, and delete your account or ask us to. Contact support@creativedistricts.africa to request access, a copy, correction or deletion of your personal information, or to object to or ask us to restrict processing. Where applicable, you can withdraw consent or request data portability. We may need to verify your identity before acting on a request.

You can raise a complaint with Kenya’s Office of the Data Protection Commissioner, or another data-protection authority with jurisdiction. Please also contact us if you believe a child has supplied personal information that needs attention.

Security and changes

We use HTTPS, authenticated access controls and checks on account ownership to protect information. No online service can guarantee complete security. We update this policy when our practices change and show the revision date above. Material changes will be brought to your attention through the service or an appropriate account communication.